Method and system for risk determination

ABSTRACT

A method for determining a risk profile of an entity of interest, comprising interrogating a social media platform to determine a social media account corresponding to the entity of interest and generating a linked social network data structure linking the social media account corresponding to the entity of interest to one or more other social media accounts on the social media platform corresponding to other entities, where an individual link is based on one or more social media interactions between the social media account corresponding to the entity of interest and each of the one or more other social media accounts corresponding to other entities. The method further involves assigning an individual link risk measure to one or more of the individual links of the linked network data structure, the individual link risk measure based on a risk assessment of the one or more social media interactions upon which the individual link is based on and a risk profile of the entity of interest based on an aggregated risk measure based on the linked social network data structure comprising the individual link risk measures.

PRIORITY DOCUMENTS

The present application claims priority from Australian ProvisionalPatent Application No 2018902753 titled “METHOD AND SYSTEM FOR RISKDETERMINATION” and filed on 30 Jul. 2018, the content of which is herebyincorporated by reference in its entirety.

TECHNICAL FIELD

The present disclosure relates to determining the risk profile of anentity having an associated online social media presence. In aparticular form, the present disclosure relates to determining a riskprofile of an entity based on their online relationships.

BACKGROUND

Determining the risk profile of entities such as a person, business,organisation or other groups is an important consideration in many areasof commercial and law enforcement activities. One example ischaracterising the risk profile of an entity to determine whether acommercial transaction should be entered into with the entity such asproviding credit or an insurance policy.

In the area of national security, where entities are subject to asecurity vetting process that allows them to hold a security clearanceor engage in activities with the law enforcement body or government,determining a risk profile is an important consideration as it allows anassessment to be made of the likelihood of future behaviour which may beproblematical. Similarly, law enforcement can also be involved inproviding “police” clearances where a cleared entity may be able toprovide a range of services such as children related activities.Typically, this involves determining whether clearance should beprovided based on past behaviour but it would be advantageous if likelyfuture behaviour could be characterised in this assessment.

With the advent of the Internet, there is a wealth of potential datathat is available online from entities particularly on social mediaplatforms such as Reddit™, Google+™, Twitter™, LinkedIn™ and the likewhich could potentially form the basis of determining a risk profile.However, the number of entities of potential interest and the sheervolume of content that is available online, in addition to itsconstantly changing nature, makes this an extremely challenging task. Intheory, the dynamically varying and interrelated nature of the contentwhich is unique to social media platforms could be employed to monitoran entity's behaviour to determine whether they may be engaging inillegal activities or posing a threat to national security or if thereis likelihood they may do so.

Analysts in the law enforcement and national security community arefaced with the difficult problem of finding “the needle in the haystack”and they employ a range of manual processes to prioritise whichpotential threats should be further investigated. Increasingly, they arelooking to online footprints, and the behaviours that might bemanifested in the online footprint, as an early indicator of risk,however, with the number of persons of interest, and the sheer volume ofonline content, it is impractical for users to monitor all persons ofinterest.

It is against this background that there is therefore a need for toolsto determine a risk profile that employs the special characteristics ofthe data available online from social media platforms.

SUMMARY

In a first aspect, the present disclosure provides acomputer-implemented method for determining a risk profile of an entityof interest, comprising:

interrogating by one or more electronic processors of a computer systema social media platform to determine a social media accountcorresponding to the entity of interest;

generating by the one or more electronic processors a linked socialnetwork data structure linking the social media account corresponding tothe entity of interest to one or more other social media accounts on thesocial media platform corresponding to other entities, wherein anindividual link is based on one or more social media interactionsbetween the social media account corresponding to the entity of interestand each of the one or more other social media accounts corresponding toother entities;

assigning by the one or more electronic processors an individual linkrisk measure to one or more of the individual links of the linkednetwork data structure, the individual link risk measure based on a riskassessment of the one or more social media interactions upon which theindividual link is based on; and

determining by the one or more electronic processors the risk profile ofthe entity of interest based on an aggregated risk measure based on thelinked social network data structure comprising the individual link riskmeasures.

In another form, interrogating the social media account comprises:

providing entity selection information characterising the entity ofinterest;

interrogating the social media platform to identify one or morecandidate social media accounts, each candidate social media accountcomprising candidate information;

ranking the one or more candidate social media accounts based on adegree of similarity between the entity selection information andcandidate information for each candidate social media account to providea set of ranked candidate social media accounts; and

selecting the social media account corresponding to the entity ofinterest from the set of ranked candidate social media accounts.

In another form, generating the linked social network data structurecomprises:

collecting data items from the social media account;

determining data items corresponding to social media activities;

determining social media interactions for the social media account basedon the social media activities that relate to an interaction between theentity of interest and another social media account corresponding toanother entity;

In another form, determining data items corresponding to social mediaactivities includes comparing a data item with a previous version of adata item to identify a change in the data item.

In another form, determining social media interactions includesdetermining whether the social media account of the entity of interestand another social media account corresponding to another entity haveinteracted with common content on the social media platform.

In another form, the risk assessment is based on a textual analysis ofthe one or more social media interactions.

In another form, the textual analysis includes a measure of a relevanceof the social media interaction in combination with a measure of asentiment of the one or more social media interactions.

In another form, the risk assessment is based on an image analysis ofthe one or more social media interactions.

In another form, an initial entity risk measure is determined for eachof the one or more other social media accounts linked to the socialmedia account of the entity of interest.

In another form, the individual link risk measure for a link between theentity of interest and an other entity is also based on the initialentity risk measure for the other entity.

In another form, the method further includes interrogating by the one ormore electronic processors additional social media platforms todetermine one or more related social media accounts corresponding to theentity of interest.

In another form, generating the linked social network data structureincludes:

for each of the related social media accounts determining links based onsocial media interactions between each of the related social mediaaccounts of the entity of interest and further social media accounts onthe social media platform or the additional social media platformscorresponding to other entities.

In another form, the linked network data structure and the risk profileof the entity of interest is updated over time.

In a second aspect, the present disclosure provides acomputer-implemented risk profiling system for determining a riskprofile of an entity of interest, comprising:

an interrogation server comprising one or more processors configured tointerrogate a social media platform to determine a social media accountcorresponding to the entity of interest;

a collection server comprising one or more processors configured togenerate a linked social network data structure linking the social mediaaccount corresponding to the entity of interest to one or more othersocial media accounts on the social media platform corresponding toother entities, wherein an individual link is based on one or moresocial media interactions between the social media account correspondingto the entity of interest and each of the one or more other social mediaaccounts corresponding to other entities;

a link analysis server comprising one or more processors configured toassign an individual link risk measure to one or more of the individuallinks of the linked network data structure, the individual link riskmeasure based on a risk assessment of the one or more social mediainteractions upon which the individual link is based on and to thendetermine the risk profile of the entity of interest based on anaggregated risk measure based on the linked social network datastructure comprising the individual link risk measures.

In another form, interrogating the social media account by theinterrogation server comprises:

providing entity selection information characterising the entity ofinterest;

interrogating the social media platform to identify one or morecandidate social media accounts, each candidate social media accountcomprising candidate information;

ranking the one or more candidate social media accounts based on adegree of similarity between the entity selection information andcandidate information for each candidate social media account to providea set of ranked candidate social media accounts; and

selecting the social media account corresponding to the entity ofinterest from the set of ranked candidate social media accounts.

In another form, generating the linked social network data structure bythe collection server comprises:

collecting data items from the social media account;

determining data items corresponding to social media activities;

determining social media interactions for the social media account basedon the social media activities that relate to an interaction between theentity of interest and another social media account corresponding toanother entity;

In another form, determining data items corresponding to social mediaactivities includes comparing a data item with a previous version of adata item to identify a change in the data item.

In another form, determining social media interactions includesdetermining whether the social media account of the entity of interestand another social media account corresponding to another entity haveinteracted with common content on the social media platform.

In another form, the risk assessment is based on a textual analysis ofthe one or more social media interactions.

In another form, the textual analysis includes a measure of a relevanceof the social media interaction in combination with a measure of asentiment of the one or more social media interactions.

In another form, the risk assessment is based on an image analysis ofthe one or more social media interactions.

In another form, an initial entity risk measure is determined by thelink analysis server for each of the one or more other social mediaaccounts linked to the social media account of the entity of interest.

In another form, the individual link risk measure for a link between theentity of interest and another entity is also based on the initialentity risk measure for the other entity.

In another form, the system includes interrogating by the collectionserver additional social media platforms to determine one or morerelated social media accounts corresponding to the entity of interest.

In another form, generating the linked social network data structure bythe link analysis server includes:

for each of the related social media accounts determining links based onsocial media interactions between each of the related social mediaaccounts of the entity of interest and further social media accounts onthe social media platform or the additional social media platformscorresponding to other entities.

In another form, the linked network data structure and the associatedrisk profile of the entity of interest is updated by the link analysisserver over time.

In a third aspect, the present disclosure provides a risk profilingsystem for determining a risk profile of an entity of interest,comprising:

one or more processors;

memory in electronic communication with the one or more processors; and

instructions stored in the memory and operable, when executed by theprocessor, to cause the system to:

interrogate a social media platform to determine a social media accountcorresponding to the entity of interest;

generate a linked social network data structure linking the social mediaaccount corresponding to the entity of interest to one or more othersocial media accounts on the social media platform corresponding toother entities, wherein an individual link is based on one or moresocial media interactions between the social media account correspondingto the entity of interest and each of the one or more other social mediaaccounts corresponding to other entities;

assign an individual link risk measure to one or more of the individuallinks of the linked network data structure, the individual link riskmeasure based on a risk assessment of the one or more social mediainteractions upon which the individual link is based on; and

determine the risk profile of the entity of interest based on anaggregated risk measure based on the linked social network datastructure comprising the individual link risk measures.

BRIEF DESCRIPTION OF DRAWINGS

Embodiments of the present disclosure will be discussed with referenceto the accompanying drawings wherein:

FIG. 1 is a system overview diagram of a risk profiling system fordetermining the risk profile of an entity of interest in accordance withan illustrative embodiment;

FIG. 2 is a flowchart of a method for determining a risk profile of anentity of interest in accordance with an illustrative embodiment thatmay be implemented on the risk profiling system illustrated in FIG. 1;

FIG. 3 is a flowchart of a method for determining the social mediaaccount of the entity of interest in accordance with an illustrativeembodiment;

FIG. 4 is a flowchart of a method for determining a linked socialnetwork data structure in accordance with an illustrative embodiment;

FIG. 5 is a depiction of the entity data structure that characterises anentity having a social media account in accordance with an illustrativeembodiment;

FIG. 6 is domain model of a linked network data structure in accordancewith an illustrative embodiment;

FIG. 7 is a depiction of a social media interaction comprising a postand follow up comment showing the use of textual matching to determine arisk measure in accordance with an illustrative embodiment;

FIG. 8 is a depiction of a social media activity comprising a postshowing the use of textual matching to determine a risk measure inaccordance with another illustrative embodiment;

FIG. 9 is a depiction of a social media activity comprising a post of animage showing the use of an image classifier and text extractor todetermine a risk measure in accordance with an illustrative embodiment;

FIG. 10 is a visual depiction of a linked network data structure showingthe links between the entity of interest and other entities inaccordance with an illustrative embodiment;

FIG. 11 is a visual depiction of an enhanced linked network datastructure comprising the linked network structure illustrated in FIG. 10expanded to the next level of links in accordance with an illustrativeembodiment;

FIG. 12 is a depiction of a social media activity comprising a postshowing the use of textual matching to determine a risk measure inaccordance with another illustrative embodiment;

FIG. 13 is a depiction of a social media activity comprising a post ofan image showing the use of an image classifier and text extractor todetermine a risk measure in accordance with an illustrative embodiment;

FIG. 14 is a depiction of a social media interaction comprising a postof an image and follow up comment and reaction showing the use of textextraction from an image to determine a risk measure in accordance withan illustrative embodiment;

FIG. 15 is a depiction of a social media interaction comprising a postand follow up comment showing the use of textual matching to determine arisk measure in accordance with an illustrative embodiment;

FIG. 16 is a visual depiction of a linked network data structure showingthe links between the entity of interest and other entities based on thesocial media activities and interactions illustrated in FIGS. 12 to 15in accordance with another illustrative embodiment;

FIG. 17 is a graph of the variation of the risk profile of an entity ofinterest over time in accordance with an illustrative embodiment; and

FIG. 18 is a system overview diagram of a risk profiling system 1000 fordetermining the risk profile of an entity of interest based on theirsocial media presence according to another illustrative embodiment.

In the following description, like reference characters designate likeor corresponding parts throughout the figures.

DESCRIPTION OF EMBODIMENTS

Referring now to FIG. 1, there is shown a system overview diagram of arisk profiling system 100 for determining the risk profile of an entityof interest based on their social media presence according to anillustrative embodiment. In this specification, the term “entity” isdefined to include, but not be limited to, individuals, groups ofindividuals, organisations, businesses or any other commercial or legalstructure.

In this specification, the term “social media platform” is defined to bean online software system comprising an online community where an entitycan create a social media account and which includes onlinecommunication channels directed to community interaction, contentsharing and collaboration allowing entities to interact with each otheronline.

Risk profiling system 100 includes a user interface 140 which isconnected to a computer system 110 comprising an electronic processorand a database 150 for the storage of electronic information. Computersystem 110 which may comprise one or more processors is connected to theInternet 120 by a network connection and is configured to interrogatesocial media platform 130 which operates in the Internet 120. In oneillustrative embodiment, user interface 140 comprises a web browser 141that connects to a complementary web portal interface served by computersystem 110 over a secure HTTPS connection.

It will be appreciated that the network connections shown are exemplaryand other ways of establishing a communications link between thecomputers can be used. The existence of any of various well-knownprotocols, such as TCP/IP, Frame Relay, Ethernet, FTP, HTTP and thelike, is presumed, and the computer can be operated in a client-serverconfiguration to permit a user to retrieve web pages from a web-basedserver. Furthermore, any of various conventional web browsers can beused to display and manipulate data on web pages.

Referring now to FIG. 2, there is shown a flowchart of a method 200 fordetermining a risk profile of an entity of interest based on theirsocial media presence according to an illustrative embodiment. In oneexample, method 200 may be implemented on the risk profiling system 100illustrated in FIG. 1 or the risk profiling system 1000 illustrated inFIG. 18.

At step 210, for a given entity of interest such as a person, the onlinesocial media platform is interrogated to determine a social mediaaccount that corresponds to the entity of interest. In one example, aninterrogation server 111 (eg, see FIG. 1) is configured to operate oncomputer system 110 and the entity of interest is entered by way of userinterface 140 consisting of a web browser 141 that connects to theinterrogation server by way of a HTTPS connection 110A.

In one example, the entity of interest is defined by a known entityidentifier such as an associated URL, username or handle for the socialmedia platform and the social media account of the entity of interestmay be determined on this basis.

More typically, the social media account for the entity of interest mustbe determined. Referring now to FIG. 3, there is shown a flowchart of amethod 210 of determining the social media account of the entity ofinterest according to an illustrative embodiment At step 211, entityselection information characterising the entity of interest is providedto risk profiling system 100, the entity selection informationincluding, but not limited to: email address, mobile phone number, age,date of birth, entity image, real world name (eg, first name, surname),alias, location (eg, city, state, country), company, industry, socialmedia association (eg, liked groups, employers), real world associations(eg, wife, friend), or any combination of the above.

At step 212, the social media platform is then interrogated by carryingout a search to identify candidate social media accounts based on theentity selection information. Depending on the social media platform,the following candidate information may be retrieved from a candidatesocial media account including, but not limited to:

-   -   account holder identity and profile information including, but        not limited to: account identifiers, usernames, person names and        aliases, date of birth, gender, education and employment        details, languages spoken, or length of membership/age of        account;    -   account holder contact information including, but not limited        to: telephone numbers or email addresses;    -   account holder associate information including, but not limited        to: family, friends, followers & people followed, forum        memberships, relationship status;    -   account holder location information including, but not limited        to: full or partial address, place of birth, school location or        other location details; or    -   account holder visual information including, but not limited to,        profile photos, photo & video albums.

At step 213, the candidate social media accounts are then ranked byinterrogation server 111. In one example, a similarity measure isdetermined for each candidate account depending on the degree ofsimilarity between the entity selection information and the candidateinformation which may also be expressed as a confidence level that thecandidate social media account is a match to the social media account ofthe entity of interest.

In one example, the degree of similarity is determined based on the typeof candidate information such as set out below:

-   -   For account holder contact type information the degree of        similarity between the entity selection information and the        candidate information may be determined by exact string matching        or “edit” distance.    -   For account holder identity and profile type information the        degree of similarity between the entity selection information        and the candidate information may be determined by “edit”        distance on person names and aliases, “edit” distance on date of        birth and binary match on gender.    -   For account holder associate type information the degree of        similarity between the entity selection information and the        candidate information may be determined by edit distance        comparing family, friends and followers.    -   For account holder location type information the degree of        similarity between the entity selection information and the        candidate information may be determined by geographical        distance.    -   For account holder visual type information the degree of        similarity between the entity selection information and the        candidate information may be determined by facial recognition        distance match.

In this example, the degree of similarity or confidence level isdetermined based on a normalised, weighted sum of the individual degreesof similarity for each of the information types referred to above.

In another example, the degree of similarity may be determined by alearnt classification model operating over the above information types.A variety of classification models may be used. In one example, aclassification model is trained on features derived from the aboveinformation types, where the features are represented as vectors in amulti-dimensional feature vector space. The classification model is thentrained to place similar social media accounts closer to each other inthe feature vector space and dissimilar social media accounts furtherapart in the feature vector space. The trained classification model isthen applied to the candidate social media accounts to obtain a rankedlist of candidate social media accounts based on the proximity to theinput entity selection information.

At step 214, the social media account corresponding to the entity ofinterest is selected from the set or list of ranked candidate socialmedia accounts. In one example, the top ranked candidate social mediaaccount is automatically determined to be the social media account ofthe entity of interest. In another example, the highest ranked candidatesocial media accounts are presented to an operator for selection of thesocial media account corresponding to the entity of interest. In yetanother example, a selection of social media accounts that are rankedabove a predetermined threshold would be nominated as individualentities of interest to which the following risk assessment processwould be applied for each case.

In this example, the user interface 140 via web browser 141 alsoprovides the capability to:

-   -   configure and manage collection of data;    -   configure risk analytics;    -   search, review and visualise the collected data and analytic        output; and    -   export data to external tools for further analysis.

In one example, interrogation server 111 includes a firewall. As wouldbe appreciated, this configuration allows for remote access to the riskprofiling system 100. In this illustrative embodiment, interrogationserver 111 communicates with social media platform by network connection110B which may include an optional firewall 160B and/or virtual privatenetwork (VPN) server in order to obfuscate the IP address of theinterrogation server 111.

In one example embodiment, risk profiling system 100 includes a HTTPSproxy server 112 (eg, see FIG. 1) configured to operate on dataprocessor 110 which allows an operator to browse the Internet via abrowser plugin in web browser 141 using the same VPN connection as theinterrogation server 111. This facility provides IP obfuscation for anyweb browsing by the operator configuring risk profiling system 100.

Referring back to FIG. 2, at step 220, a linked social network datastructure is determined that links the social media account of theentity of interest to one or more other social media accounts on thesocial media platform where the link is based on a social mediainteraction between the entity of interest's social media account andthe other social media accounts.

Referring now to FIG. 4, there is shown a flowchart of one examplemethod 220 for determining a linked social network data structure. Atstep 221, in this illustrative embodiment, once the social media accountcorresponding to an entity of interest has been determined, a collectionserver 113 (eg, see FIG. 1) configured to operate on computer system 110functions to collect data items from the social media account of theentity of interest to populate an entity data structure 300corresponding to the entity of interest for storage in database 150.

Referring now to FIG. 5, there is shown an entity data structure 300according to an illustrative embodiment which characterises an entity310 having a social media account 320. The social media account 320includes one or more data items 330 which may include entity detailsthat describe the entity 310 and further include configuration detailspertaining to the social media platform. Data items 330 may also includemultimedia data such as text, images, videos and audio and derived dataitems that are unique to the social media platform such as social mediaaccount metadata comprising profile information including, but notlimited to: gender, age, nationality, place of residence, place ofbirth, education, marital status and religion.

At step 222, collection server 113 classifies data items 330 as socialmedia activities 340 that are performed by the entity 310 on the socialmedia platform including, but not limited to, social media activitiessuch as posts, reposts, shares, comments, replies, joining groups,adding and removing friends/followers or reactions (eg, likes).

In one example, the classification of a data item 330 as a social mediaactivity 340 may occur as a result of comparing a data item with aprevious version of a data item in order to identify changes. In oneillustrative example, a comparison of a data item 330 listing thefriends or connections of an entity on a social media account may becompared to an earlier version to generate one or more “Added aFriend/Connection/Follower” social media activities for that data item330 depending on the number of friends or connections added since theprevious collection.

In another example, a visual change in an entity's profile picture maybe classed as a social media activity. In a further example, a change inmembership in respect of an online community such as a group,organisation or like may be classed as a social media activity. In yetanother example, a change in the volume of content or interactions overa predetermined time such as a significant increase/decrease or halt inactivity may be classed as a social media activity. In another example,an actual activity such as an entity changing location (eg, going onholiday) will be classed as a social media activity.

At step 223, collection server 113 identifies and classifies socialmedia activities determined in the previous step as social mediainteractions. In this illustrative embodiment, a social mediainteraction is a social media activity 340 associated with an entity 310which concerns an interaction between the entity of interest and anothersocial media account that corresponds to another entity.

Examples of social media interactions include, but are not limited to:

-   -   the entity of interest connecting to another social media        account corresponding to another entity (eg, becoming a follower        or friend or joining a group, forum or online community);    -   the entity of interest disconnecting from another social media        account corresponding to another entity (eg, ceasing to be a        follower or friend or leaving a group, forum or online        community);    -   the entity of interest reacting to another social media account        corresponding to another entity (eg, liking, disliking or        otherwise reacting);    -   the entity of interest interacting with content from another        social media account such as by commenting on, replying to,        reacting to, quoting, reposting or sharing the initial content        from their social media account; or    -   the entity of interest mentioning, tagging or referring to        another entity or the social media account corresponding to        another entity.

In one example, the entity of interest may be commenting or otherwiseinteracting with social media content such as a post from a group orforum page or an otherwise unrelated entity on the social media platformand another entity also interacts with the same social media content by,for example, also commenting on the same post. This social mediaactivity is then also classified as a social media interaction betweenthe entity of interest and the other entity on the basis that they haveboth interacted with common content on the social media platform.

At step 224, the collection server 113 generates the linked socialnetwork data structure centred about the entity of interest andcomprising links to each of the other social media accountscorresponding to other entities where a link requires there to be atleast one social media interaction between the social media account ofthe entity of interest and the linked social media account of the otherentity.

Referring now to FIG. 6, there is shown a domain model 400 of a linkedsocial network data structure 410 according to an illustrativeembodiment. Linked social network data structure 410 consists of one ormore entities 420 including the entity of interest and other entitiesthat are connected to the entity of interest by links 450 which comprisethe linked social network structure 410. The links 450 that connect theentities are based on the social media interactions 440 which are asubset of the social media activities 430 performed by the entity ofinterest that involve at least one other entity. In this manner, thelink connecting entities is comprised of, or characterises, all thesocial media interactions 440 between those two entities.

In one example, the process of generating the linked social networkstructure 410 will also involve automatically populating respectiveentity data structures 300 for the other entities that are linked to theentity of interest. In this manner, selection of an entity of interestwill then automatically generate a linked social network data structurecomprising other entities as well as their associated populated entitydata structures which in turn may characterise links between these otherentities.

Referring back to FIG. 2, at step 230 an individual link risk measure isassigned to links of the linked network data structure where theindividual link risk measure is based on a risk assessment of the one ormore social media interactions upon which the link is based on. In oneembodiment, a link analysis server 114 configured to operate on computersystem 110 carries out this process (eg, see FIG. 1).

In one example, the risk assessment comprises a textual analysis of anytext forming part of the data item that forms the basis for the socialmedia interaction. This can also include text extracted from images byoptical character recognition techniques. In one embodiment, the textualanalysis includes matching words or phrases to a predetermined list ofwords/phrases that are of interest. In one example, the predeterminedlists of words/phrases may be divided into different categories ofinterest for the risk profiling activity.

Referring now to FIG. 7, there is shown a social media interaction 500comprising a comment 521 made by a related entity 520 to a post 511 on asocial media post made by the entity of interest 510. In this example,the term “ISLAMIC STATE” has been identified by textual matching 530 andfurther the term “KUFFAR” was identified in the comment made by therelated entity. Textual matching may be divided into a number ofcategories and in this example, the term “ISLAMIC STATE” has beencategorised in the “islamic state” category and the term “kuffar” hasbeen categorised in the “Derogation” category.

Referring now to FIG. 8, there is shown a social media activity 600comprising a post 611 made by an entity 610 on a social media platform.In this example, the indicated quote 612 was identified by textualmatching 630 to a list of texts categorised into different libraries. Inthis example, the indicated quote 612 was categorised as belonging to apublication or text in the library “Library-Ideology” 631.

In one embodiment, the textual analysis includes determining a riskmeasure for a given social media interaction in the form of a binaryscore associated with the presence or absence of words from apredetermined list of words or phrases such as quotes from relevanttexts.

In another embodiment, the textual analysis includes determining a riskmeasure for a given social media interaction in the form of a continuousscore between zero and one that measures the relevance of thisinteraction to a category of interaction subject topics (eg, “drugs”,“alcohol” or “ideology”). In this example, a given category is firstcharacterised by a set of predetermined words/phrases relevant to thatcategory. Each of these words/phrases is then represented in a highdimensional vector space constructed so that contextually andsemantically similar words are located near to each other. The textualcontent of the social media interaction is then projected into this highdimensional vector space and the risk measure is then determined bycalculating a distance measure in this high dimensional vector spacenormalised between zero and one.

In another embodiment, the textual analysis includes determining acombination risk measure for a given social media interaction in theform of a continuous score between zero and one that measures therelevance of the social media interaction to a category of interactionsubject topics (eg, “drugs”, “alcohol” or “ideology”) combined with acontinuous score between zero and one that measures a specific sentimentfor the social media interaction (eg, “happy”, “fearful”, “angry”). Inone example, a sentiment classifier is trained using a training corpuscomprising a set of social media posts with their associated reactions(eg, like, love, hate etc.). These reactions are then used as asubstitute for human labels defining positive, negative or neutralsentiment for a given social media posts. The words and phrases in thoseposts and the associated reactions are then used to train the sentimentclassifier to recognise the sentiment of input text arising from thesocial media interaction.

In another embodiment, the risk assessment comprises an image analysisof any images forming part of the data item that forms the basis for thesocial media interaction to determine whether the images contain objectsfrom a predetermined list of objects of interest. In another example,the image analysis determines whether the images contain logos from apredetermined list of logos of interest. In another example, the imageanalysis determines whether the images contain faces from apredetermined list of faces of interest.

Referring now to FIG. 9, there is shown a social media activity 700comprising a post 710 made by an entity on a social media platformcomprising an image 711 which has been classified by an image classifier730 to determine whether it contains any objects of interest. As can beseen, the image classifier 730 has determined that the image contains anumber of objects of interest 731 in this case in the category“mujahideen” 732. In this example, image classifier 730 has alsoextracted text 740 present in the image.

100931 In this manner, each social media interaction may be assigned arisk measure following risk assessment of the social media interactionand then any link between two entities based on one or more social mediainteractions may be assigned an individual link risk measure based onthe determined risk measures for the one or more social mediainteractions that form the basis for the link between the entity ofinterest and the other entity.

In one example, the individual link risk measure may comprise a numberof sub-measures pertaining to different risk assessment categories suchas a sub-measure directed in one example to “ideology” and a sub-measuredirect to “weapons” which may be reviewed separately. In anotherexample, the sub-measure is determined for each social media interactionacross all risk assessment categories to allow identification of highrisk social media interactions that could occur.

In another example, the individual link risk measure may include a riskmeasure based on the number of social media interactions betweenentities that occur for a predetermined time period or any changes inthis number over successive time periods.

In another example, the individual link risk measure may include aweighted sum where the weight is attributed to the type of social mediainteraction from the perspective of the entity of interest based on adegree of interaction measure of the social media interaction. In oneexample, for given content that has a high risk measure as determined byrisk assessment, the degree of interaction measure would be higher ifthe entity of interest posted the content as opposed to commenting onthe content. Correspondingly, the degree of interaction measure would behigher for commenting on the content compared to the case of the entityof interest reposting the content without comment which in turn wouldhave a higher degree of interaction measure as compared to the situationof where the entity of interest just “liked” the content.

In another illustrative embodiment, each social media activity for eachentity in the linked social network data structure is assigned anactivity risk measure based on the data item forming the basis for thesocial media activity. In this example, each entity may be assigned aninitial entity risk measure based on the social media activities theyenter into on the social media platform without regard to whether thosesocial media activities are related to an interrelationship between twoor more entities.

This initial entity risk measure may then be used to weight theindividual link risk measure. As an example, the individual link riskmeasure for a link between the entity of interest and another entitybased on their social media interactions where the other entity hasinitial entity risk measure that is high based on an assessment of theirgeneral social media activities on the social media platform would beweighted higher than the same individual link risk measure where theother party has a low initial entity risk measure.

In another example, an initial entity risk measure may be assigned to orprescribed for an entity, as a result enhancing the individual link riskmeasure for any entity of interest that has a social media interactionwith this entity.

Referring now to FIG. 10, there is shown a visual depiction of a linkednetwork data structure 800 according to an illustrative embodiment. Inthis example, the entity of interest (EOI) 810 is linked to the otherentities (E1, E2 and E3) where an individual link is based on one ormore social media interactions as has been previously described. By wayof example, EOI 810 is linked to other entities E1, E2, and E3, byrespective links 841, 842 and 843.

In this example, the number of social media interactions between anentity and another entity is shown by the weight or thickness of theline with a thicker line representing more social media interactionsbetween the linked entities. Where the individual link risk measure fora link connecting entities exceeds a risk threshold then the line inthis example is dashed.

Where an initial entity risk measure is determined, in the examplevisual depiction of FIG. 10, the size of the box indicating an entity inthe linked network data structure 800 will reflect this initial entityrisk measure which may be used to weight the individual link riskmeasure as described above. In the example visual depiction of FIG. 10,were the initial entity risk measure exceeds a threshold then the boxoutline is dashed.

As would be appreciated, the visual depiction illustrated in FIG. 10 isbut one example. In another example, colour coding may also be used toindicate where various risk measure thresholds have been exceeded. Aswould also be appreciated, the linked network data structure 800 of FIG.10 is highly simplified to illustrate the principles of the presentdisclosure and in a real use case there may be large number of links toother social media accounts corresponding to other entities.

As would be appreciated, visual depictions of the linked network datastructure in accordance with the example illustrated in FIG. 8 allow anoperator to extremely rapidly determine the level of risky engagementbetween an entity of interest and other entities in the social medianetwork of the entity of interest.

Referring now to FIG. 11, there is shown a visual depiction of anenhanced linked network data structure 900 comprising the linked networkstructure (Level 1), ie E1, E2 and E3, illustrated in FIG. 10 expandedto the next level of links (Level 2), ie E4, E5, E6, E7, E8, E9, E10,E11, E12, E13 and E14, according to an illustrative embodiment. In thisexample, for each of the entities that are linked to the entity ofinterest a further level of links is determined to generate enhancedlinked network data structure 900 by determining social mediainteractions between the entity at the first level and entities at thesecond level and then assigning individual link risk measures to each ofthese links based on risk assessment of the respective social mediainteractions.

In one example, the links between Level 1 and Level 2 may be used todetermine the initial entity risk measure for those entities on Level 1which will further feed in to determining the individual link measuresbetween the Level 1 entities and the entity of interest. In this way,entities that are more than one level removed from the entity ofinterest may be utilised in determining the risk profile of the entityof interest. As would be appreciated, the process may be repeated againto generate the next level of linked entities (ie, Level 3) and so on.

In the example shown in FIG. 11, once the Level 2 entities have beenidentified then links between these Level 2 entities and other Level 2or Level 1 entities are determined. The resulting topology of the linkednetwork data structure 900 as a result provides insight into howdisparate entities may be indirectly linked together.

In another embodiment, it is possible to filter the linked network datastructure based on the type of social media interaction. In one example,the filtered linked network data structure is based on a social mediainteraction where one entity has followed another entity. In anotherexample, the filtered linked network data structure is based on a socialmedia interaction where one entity has reacted to a social media post oractivity by another entity. In yet another example, the filtered linkednetwork data structure is based on a social media interaction where oneentity has commented on a social media post or activity of anotherentity. As would be appreciated, this ability to filter the linkednetwork data structure in accordance with the type of social mediainteraction provides additional insight into the type of linkagesbetween the entities in the structure.

Referring again to FIG. 2, at step 240 the risk profile for the entityof interest is determined based on an aggregated risk measure combiningthe individual link risk measures determined between the entity ofinterest and the linked entities based on the linked social network datastructure now comprising the individual link risk measures. In oneexample, the risk profile may be based on risk measures aggregated overdifferent risk assessment categories or topics such as “ideology” and“weapons” as has been previously described so that these may beseparately examined. In one example embodiment, the link analysis server114, configured to operate on computer system 110, functions todetermine the risk profile.

Referring now to FIGS. 12 to 15, there are shown depictions of a numberof social media activities and interactions and an associated linkednetwork data structure 1600 illustrated in FIG. 16 relating todetermining a risk profile based on antisocial behaviour such as alcoholconsumption and gambling.

Referring now to FIG. 12, there is shown a social media activity 1200comprising a post 1211 by an entity of interest 1210. In this example,the terms “poker” and “drinks” have been identified in the “Alcohol”1221 and “Gambling” 1222 categories which are of interest in this riskassessment exercise. Referring now to FIG. 13, there is shown a socialmedia activity 1300 by the entity of interest 1210 comprising a post1315 including text 1313 and an image 1314. In the text, the term“drink” has been identified in the “Alcohol” category 1221. As can beseen by inspection, image 1314 is a picture of fridge full of alcohol.Image classifier 1330 has determined a number of relevant objects 1331in the category “distilled beverage” 1332. In this example, imageclassifier has also extracted text 1340 from the image which is analcohol brand which has been identified in the “Alcohol” category 1221.

Referring now to FIG. 14, there is shown a social media interaction 1400comprising a reaction 1451 in the form of “like” and a comment 1452 (notshown) in relation to a social media activity comprising a post 1415 byan entity of interest 1210 including text 1413 and an image 1414. As canbe seen in this example, textual matching did not identify relevantmaterial in the text 1413 of the post 1415 and the image classifier didnot identify any objects in the image 1414 which is a bettingtransaction record, however, the image classifier extracted the text1440 from image 1414 and the term “bet” has been identified in the“Gambling” category 1222.

Referring now to FIG. 15, there is shown a social media interaction 1500comprising a comment 1573 made by a related entity 1570 to a post 1513on a social media post made by the entity of interest 1210. In thisexample, the term “booze” has been identified by textual matching 1530and has been further identified or classified in the “Alcohol” category1221.

Referring now to FIG. 16, there is shown a visual depiction of a linkednetwork data structure 1600 based on social media activities andinteractions of the type illustrated in FIGS. 12 to 15 comprising inthis example two levels similar to FIG. 11. In this example, each of theentities including the entity of interest 1610 is represented by aprofile picture or image related to the entity. Similar to the linkednetwork data structure illustrated in FIGS. 10 and 11, each of theindividual links is based on one more social medial interactions.

In this example, the thickness of the link indicates that number ofsocial media interactions between the linked entities and the darknessof the link corresponds to the individual link risk measure for the linkconnecting the entities. In those examples, where the assessed risk ofan entity exceeds a threshold based on their social media activities theentities name is highlighted explicitly as shown for entities 1681,1682, 1683. In this illustrative example, entity 1682 relates to a venuethat provides alcohol and gambling services.

In another embodiment, the linked network data structure is updated on aperiodic basis resulting in the associated risk profile of the entity ofinterest being updated over time. Referring now to FIG. 17, there isshown a graph 1700 of the variation of the risk profile or score 1710 ofan entity of interest over time according to an illustrative embodiment.As would be appreciated, this allows the risk trajectory 1720 of anentity of interest to be tracked and inspected to determine whetherthere has been a change in behaviour that could trigger follow up orreclassification of the entity of interest.

In one example, where the risk profile includes separate risk assessmentcategories the updated risk profile may be used to determine changes inbehaviour at a category or topic level and further define combinedmeasures which detect changes in more than one selected categories.

Taking the example above with categories “ideology” and “weapons” thefollowing may be determined:

-   -   the risk score per category at any given time (eg, in September        the score for “ideology” was 0.9 (high) or 0.1 (low));    -   changes and rates of change in risk score for a given risk        category (eg, from July to September the “ideology” score moved        from 0.1 (low) to 0.9 (high)); and    -   sequences of elevated risks (eg. the entity of interest had a        high score for the “ideology” category in September, followed by        an increasing and elevated risk score in the “weapons” category        from October to December which may indicate a pattern of        concerning behaviour.

In another embodiment, a risk profiling system in accordance with thepresent disclosure may be expanded to operate over additional socialmedia platforms. As with determining the social media account on theprimary social media platform, entity selection information may be usedto identify and match to candidate social media accounts on theadditional social media platforms. Where a social media account has beenidentified for the entity of interest on the primary social mediaplatform, then information from the already identified social mediaaccount may be used preferentially as entity selection information toidentify and match to candidate social media accounts on the additionalsocial media platforms.

In one example, a matching candidate social media account on a furthersocial media platform may be assessed by measuring the similaritybetween the account metadata of the entity of interest on the firstsocial media platform with that of the candidate social media account onthe further social media platform. In another example, the assessmentmay be based on the degree of similarity of the account content betweenthe two social media accounts on the different social media platforms.In another example, the assessment may be based on a degree ofsimilarity of the social networks between the two social media accountson the different social media accounts. In another example, theassessment may be based on a similarity measure comprising multipleweighted sub-measures of similarity.

Once the additional social media accounts corresponding to the entity ofinterest have been identified then social media activities may bedetermined and the social media interactions between the entity ofinterest and other entities on the additional social media platforms maybe classified and form the basis of links between the entity of interestand the other entities. In some instances, the social media interactionwill involve two different social media platforms, eg, an article postedon a first social media platform by the entity of interest could beshared by another entity on a second social media platform where theyhave a social media account.

Some other types of interactions between different social mediaplatforms include, but are not limited to the following:

-   -   including a link to social media content such as a post, photo        or video from the second social media platform into a post on        the first social media platform.    -   including an entity mention (eg, user handle) from the second        social media platform into a post on the first social media        platform.    -   including an entity mention (eg, user handle) from the second        social media platform in the metadata (eg, “about” information)        for an entity on the first social media platform.

Referring now to FIG. 18, there is shown a system overview diagram of arisk profiling system 1000 for determining the risk profile of an entityof interest based on their social media presence according to anotherillustrative embodiment.

As would be appreciated the various computer modules, servers anddatabases and data stores described both above and below may beimplemented on a computer system 1010 which may comprise any combinationof multiple different individual hardware or software processorsconfigured to run the various computing tasks that are described infunctional terms below. In this illustrative embodiment, the computingsystem is based on a web architecture where the webserver 1018 functionsto provide the middle tier between the Internet 1020 and the operator1090 of the risk profiling system 1000. In this manner, the userinterface 1040 of the risk profiling system 1000 consists of webpages orcontent served by the webserver and is accessed by a standard webbrowser as a “web” application 1041 by the operator 1090.

The web based architecture allows an operator 1090 to access theapplication from any device with a modern web browser, eg, a desktop PCor tablet. As such, this architecture does not require an operator 1090to install specific software to use the application. It also providesflexibility when deploying the application as the server-side componentmay be deployed either on hardware managed by the operator's 1090organisation, or in a cloud environment and managed on their behalf

An alternative architecture that may be adopted for a web profilingsystem in accordance with the present disclosure is termed a“thick-client” architecture where the user interface is provided by adesktop application or app installed on the operator's device. Thiswould still require a server component to support the functionality butcan provide an enhanced user experience that is more integrated with thedevice capabilities or operating system that the application isinstalled on.

In this example, risk profile system 1090 includes a reverse proxy 1087which functions as an intermediary between the operator 1090 who may beaccessing the risk profiling system 1000 remotely by the Internet andthe webserver application 1018 of the risk profiling system 1000. Inthis example, network traffic is secured between the user interface 1040and reverse proxy 1087 by adopting the secure HTTPS (HTTPS) protocolwhile network traffic between webserver 1018 and the reverse proxy 1087need not be encrypted as it is internal to the risk profiling system1000 and uses the standard HTTP protocol. As would be appreciated, wherethe various components or server applications of the risk profilingsystem may be remotely distributed then network traffic between thesecomponents may be encrypted as required.

In this illustrative embodiment, the network traffic between the webapplication 1041 and the server 1018 employs a Representational StateTransfer (REST) API that defines a set of messages and operations thatcan be exchanged over HTTP. This API is used to configure the riskprofiling system 1000 and retrieve the results of the risk profiledeterminations. The REST API provides an interface to the risk profilingsystem 1000 and may be accessed by different user facing applications,eg, an iOS app could be developed that uses the same API calls as theweb application 1041.

In this example, risk profiling system 1000 accesses the internet 1020by a third party VPN provider that provides access to the Internet 1020by a VPN server 1080 to which risk profiling system 1000 connects to bya VPN client 1085 forming in this example a component or module of therisk profiling system 1000. As a result, all of the network trafficbetween the internet 1020 and the risk profiling system 1000 may beencrypted by virtue of the secure socket layer (SSL) connection betweenthe VPN client 1085 and the VPN server 1080 and the HTTPS links betweenthe VPN server 1080 and the Internet 1020. In this example, an operator1090 may also access the Internet generally through their access to therisk profiling system 1000 by the web browser based user interface 1040as will be described below.

Risk profiling system 1000 communicates via the VPN Server/Clientarrangement 1080, 1085 to interrogate social media platforms 1022 (egSMP 1, SMP 2, . . . , SMP N) as described above. In this illustrativeembodiment, risk profiling system 1000 can also connect to various cloudbased application programing interfaces 1023 (eg, API 1, API 2, . . . ,AMP N) to provide specialised based machine learning and artificialintelligence type processing available on the Internet to risk profilingsystem 1000. In one example, a cloud based API may provide a translationcapability. In another example, a cloud based API may provide an imageobject classification capability. As well as ensuring all datacommunications to and from the Internet are encrypted, use of the VPNServer/Client arrangement 1080, 1085 also functions to obfuscate thesource IP address of the risk profiling system 1000 to provide anonymityfor risk profiling system 1000 and operator 1090.

Risk profiling system 1000 further includes an interrogation server 1011operable to interrogate social media platforms 1022 as has beendescribed above. In this embodiment, interrogation server 1011 comprisesa webscraping module 1070 that can instantiate multiple instances of aweb browser 1071. Webscraping module 1070 interfaces to the riskprofiling system 1000 by a driver interface 1072 that processesinterrogation requests from the risk profiling system 1000 intoequivalent HTTP requests operable on each of the social media platforms1022. In this manner, content is “scraped” from the social mediaplatforms 122 for further processing.

In one example, the interrogation server 1011 employs user-providedcredentials to access the social media platforms. These credentials canbe an API key or a username and password for authenticating to thesocial media platform's web interface. For API keys, the applicationmakes API requests to collect data from the social media platform. Forcredentials where there is a username and password, the webscrapingmodule 1070 starts a web browser 1071 and programmatically controls itto login using the provided credentials, browse to the appropriate pageand read content from the page. From the social media platform'sperspective, the application appears to be a user browsing theirservice. This web-scraping collection method provides access to allcontent visible to a logged in user which may be more than would beavailable via API-based collection methods to the particular socialmedia platform.

In one example, the content from the webscraping module 1070, and inparticular the video and image data content, is stored on a distributedfault tolerant no-SQL database 151 that provides data distributionacross a cluster of nodes for data replication purposes. In one example,database 151 is a RIAK based database. In other embodiments, thedatabase could be a Redis key-value store or any S3-compatible objectstore.

In this example, risk profiling system 1000 further includes a HTTPSproxy server 1012 that allows the operator 1090 to connect to theInternet 1021 by VPN Server and Client 1080, 1085 arrangement using thesame IP address as the risk profiling system 1000. In this example, theweb browser employed by operator 1090 includes an SSL proxy extension orplugin 1042 which connects by HTTPS to the HTTPS proxy server 1012. Aswould be appreciated, this allows the operator 1090 to both securely andanonymously browse the general Internet 1020 while operating riskprofiling system 1000, while presenting the same IP address as the riskprofiling system 1000 to the social media platforms.

Risk profiling system 1000 includes a collection server 1013 thatfunctions to process the content returned by webscraping module 1070 andstored in database 1051 as collected data items and then populate anentity data structure that corresponds to the entity of interest as hasbeen described above. Collection server 1013, in this example, alsofunctions to classify or identify collected data items as a social mediaactivity and then further as a social media interaction where the socialmedia activity concerns an interaction between the entity of interestand another social media account corresponding to another entity. Inthis example, the other social media account may be on a differentsocial media platform (eg, SMP 2) as compared to the social mediaplatform that is being examined for the entity of interest (eg, SMP 1).

Risk profiling system 1000 further includes a link analysis server 1014that functions to generate the linked social network data structureassign the individual link risk measures and then determine the riskprofile of the entity of interest as has been described above. In thisexample, the data associated with the entity data structure and thelinked social network data structure determined by risk profiling system1000 is stored in a no-SQL database 152 which in this example is a3-node Elasticsearch™ cluster. Elasticsearch is a database or datastoreoptimised for searching large collections of semi-structured documents.Elasticsearch constructs an inverted index that allows the applicationto efficiently lookup content in text fields, eg, searching for a wordin the text of posts on social media. The datastore supports “fuzzy”searches, eg, by synonyms or misspellings. In another example, thedatastore is Solr™. In this example, link analysis server 1014 mayconnect to cloud based APIs 1023 to assist in the analysis task by VPNServer/Client arrangement 1080, 1085.

In this example, risk profiling system 1000, being based on a webserverarchitecture, also includes command and control module 1019, thatfunctions to implement the risk profiling method in accordance with thepresent disclosure. Data associated with the application state of therisk profiling system 1000 such as processor status, pending taskdetails and log and error data are stored in a standard relationaldatabase 1053. Risk profiling system 1000 in this embodiment furtherincludes a support module 1048 that allows an operator to access thesystem through a SSH link to monitor and maintain the risk profilesystem 1000. The SSH connection allows an operator 1090 to login to thewebserver 1018 from a remote location to facilitate maintenance. SSHaccess provides a terminal where the operator 1090 can execute commandsto, eg, patch or reboot the webserver 1018. In one example, the webapplication 1041 provides an operator 1090 with an administrator roleaccess to additional features that can support operational maintenance,eg, monitoring running tasks.

Those of skill in the art would further appreciate that the variousillustrative logical blocks, modules, circuits, and algorithm stepsdescribed in connection with the embodiments disclosed herein may beimplemented as electronic hardware, computer software or instructions,or combinations of both. To clearly illustrate this interchangeabilityof hardware and software, various illustrative components, blocks,modules, circuits, and steps have been described above generally interms of their functionality. Whether such functionality is implementedas hardware or software depends upon the particular application anddesign constraints imposed on the overall system. Skilled artisans mayimplement the described functionality in varying ways for eachparticular application, but such implementation decisions should not beinterpreted as causing a departure from the scope of the presentinvention.

In various embodiments of the present disclosure, a single component maybe replaced by multiple components, and multiple components may bereplaced by a single component, to perform a given function orfunctions. Except where such substitution would not be operative topractice embodiments of the present disclosure, such substitution iswithin the scope of the present disclosure. In accordance with this, anyof the servers described in the present disclosure may be implemented aslogical processes on a single computer processor or alternativelydistributed amongst a group of networked servers that are located andconfigured for cooperative functions.

Various embodiments of the systems and methods of the present disclosuremay employ one or more electronic computer networks to promotecommunication among different components, transfer data, or to shareresources and information. Such computer networks can be classifiedaccording to the hardware and software technology that is used tointerconnect the devices in the network, such as optical fibre,Ethernet, wireless LAN, HomePNA, power line communication or G.hn. Thecomputer networks may also be embodied as one or more of the followingtypes of networks: local area network (LAN); metropolitan area network(MAN); wide area network (WAN); virtual private network (VPN); storagearea network (SAN); or global area network (GAN), among other networkvarieties.

Throughout the specification and the claims that follow, unless thecontext requires otherwise, the words “comprise” and “include” andvariations such as “comprising” and “including” will be understood toimply the inclusion of a stated integer or group of integers, but notthe exclusion of any other integer or group of integers.

The reference to any prior art in this specification is not, and shouldnot be taken as, an acknowledgement of any form of suggestion that suchprior art forms part of the common general knowledge.

It will be appreciated by those skilled in the art that the invention isnot restricted in its use to the particular application described.Neither is the present invention restricted in its preferred embodimentwith regard to the particular elements and/or features described ordepicted herein. It will be appreciated that the invention is notlimited to the embodiment or embodiments disclosed, but is capable ofnumerous rearrangements, modifications and substitutions withoutdeparting from the scope of the invention as set forth and defined bythe following claims.

1. A computer-implemented method comprising: interrogating by one ormore electronic processors of a computer system a social media platformto determine a social media account corresponding to an entity ofinterest; generating by the one or more electronic processors a linkedsocial network data structure linking the social media accountcorresponding to the entity of interest to one or more other socialmedia accounts on the social media platform corresponding to otherentities, wherein an individual link is based on one or more socialmedia interactions between the social media account corresponding to theentity of interest and each of the one or more other social mediaaccounts corresponding to other entities; assigning by the one or moreelectronic processors an individual link risk measure to one or more ofthe individual links of the linked social network data structure, theindividual link risk measure based on a risk assessment of the one ormore social media interactions upon which the individual link is basedon; and determining by the one or more electronic processors the a riskprofile of the entity of interest based on an aggregated risk measurebased on the linked social network data structure comprising theindividual link risk measures.
 2. The computer-implemented method ofclaim 1, wherein interrogating the social media account comprises:providing entity selection information characterising the entity ofinterest; interrogating the social media platform to identify one ormore candidate social media accounts, each candidate social mediaaccount comprising candidate information; ranking the one or morecandidate social media accounts based on a degree of similarity betweenthe entity selection information and candidate information for eachcandidate social media account to provide a set of ranked candidatesocial media accounts; and selecting the social media accountcorresponding to the entity of interest from the set of ranked candidatesocial media accounts.
 3. The computer-implemented method of claim 1,wherein generating the linked social network data structure comprises:collecting data items from the social media account; determining dataitems corresponding to social media activities; and determining socialmedia interactions for the social media account based on the socialmedia activities that relate to an interaction between the entity ofinterest and another social media account corresponding to anotherentity;
 4. The computer-implemented method of claim 3, whereindetermining data items corresponding to social media activities includescomparing a data item with a previous version of the data item toidentify a change in the data item.
 5. The computer-implemented methodof claim 1, wherein determining social media interactions includesdetermining whether the social media account of the entity of interestand another social media account corresponding to another entity haveinteracted with common content on the social media platform.
 6. Thecomputer-implemented method of claim 1, wherein the risk assessment isbased on a textual analysis of the one or more social mediainteractions.
 7. The computer-implemented method of claim 6, wherein thetextual analysis includes a measure of a relevance of the one or moresocial media interactions in combination with a measure of a sentimentof the one or more social media interactions.
 8. Thecomputer-implemented method of claim 1, wherein the risk assessment isbased on an image analysis of the one or more social media interactions.9. The computer-implemented method of claim 1, wherein an initial entityrisk measure is determined for each of the one or more other socialmedia accounts linked to the social media account of the entity ofinterest.
 10. The computer-implemented method of claim 9, wherein theindividual link risk measure for a link between the entity of interestand another entity is also based on the initial entity risk measure forthe other entity.
 11. The computer-implemented method of claim 10,further including interrogating by the one or more electronic processorsadditional social media platforms to determine one or more relatedsocial media accounts corresponding to the entity of interest.
 12. Thecomputer-implemented method of claim 11, wherein generating the linkedsocial network data structure includes: for each of the related socialmedia accounts determining links based on social media interactionsbetween each of the related social media accounts of the entity ofinterest and further social media accounts on the social media platformor the additional social media platforms corresponding to otherentities.
 13. The computer-implemented method of claim 1, wherein thelinked social network data structure and the risk profile of the entityof interest is updated over time.
 14. A computer-implemented systemcomprising: an interrogation server comprising one or more processorsconfigured to interrogate a social media platform to determine a socialmedia account corresponding to an entity of interest; a collectionserver comprising one or more processors configured to generate a linkedsocial network data structure linking the social media accountcorresponding to the entity of interest to one or more other socialmedia accounts on the social media platform corresponding to otherentities, wherein an individual link is based on one or more socialmedia interactions between the social media account corresponding to theentity of interest and each of the one or more other social mediaaccounts corresponding to other entities; and a link analysis servercomprising one or more processors configured to assign an individuallink risk measure to one or more of the individual links of the linkedsocial network data structure, the individual link risk measure based ona risk assessment of the one or more social media interactions uponwhich the individual link is based on and to then determine a riskprofile of the entity of interest based on an aggregated risk measurebased on the linked social network data structure comprising theindividual link risk measures.
 15. The computer-implemented system ofclaim 14, wherein interrogating the social media account by theinterrogation server comprises: providing entity selection informationcharacterising the entity of interest; interrogating the social mediaplatform to identify one or more candidate social media accounts, eachcandidate social media account comprising candidate information; rankingthe one or more candidate social media accounts based on a degree ofsimilarity between the entity selection information and candidateinformation for each candidate social media account to provide a set ofranked candidate social media accounts; and selecting the social mediaaccount corresponding to the entity of interest from the set of rankedcandidate social media accounts.
 16. The computer-implemented system ofclaim 14, wherein generating the linked social network data structure bythe collection server comprises: collecting data items from the socialmedia account; determining data items corresponding to social mediaactivities; and determining social media interactions for the socialmedia account based on the social media activities that relate to aninteraction between the entity of interest and another social mediaaccount corresponding to another entity.
 17. The computer-implementedsystem of claim 16, wherein determining data items corresponding tosocial media activities includes comparing a data item with a previousversion of the data item to identify a change in the data item.
 18. Thecomputer-implemented system of claim 14, wherein determining socialmedia interactions includes determining whether the social media accountof the entity of interest and another social media account correspondingto another entity have interacted with common content on the socialmedia platform.
 19. The computer-implemented system of claim 14, whereinthe risk assessment is based on a textual analysis of the one or moresocial media interactions.
 20. The computer-implemented system of claim19, wherein the textual analysis includes a measure of a relevance ofthe one or more social media interactions in combination with a measureof a sentiment of the one or more social media interactions.
 21. Thecomputer-implemented system of claim 14, wherein the risk assessment isbased on an image analysis of the one or more social media interactions.22. The computer-implemented system of claim 14, wherein an initialentity risk measure is determined by the link analysis server for eachof the one or more other social media accounts linked to the socialmedia account of the entity of interest.
 23. The computer-implementedsystem of claim 22, wherein the individual link risk measure for a linkbetween the entity of interest and another entity is also based on theinitial entity risk measure for the other entity.
 24. Thecomputer-implemented system of claim 23, further including interrogatingby the collection server additional social media platforms to determineone or more related social media accounts corresponding to the entity ofinterest.
 25. The computer-implemented system of claim 24, whereingenerating the linked social network data structure by the link analysisserver includes: for each of the related social media accountsdetermining links based on social media interactions between each of therelated social media accounts of the entity of interest and furthersocial media accounts on the social media platform or the additionalsocial media platforms corresponding to other entities.
 26. Thecomputer-implemented system of claim 14, wherein the linked socialnetwork data structure and the risk profile of the entity of interest isupdated by the link analysis server over time.
 27. A system comprising:one or more processors; memory in electronic communication with the oneor more processors; and instructions stored in the memory and operable,when executed by the one or more processors, to cause the system to:interrogate a social media platform to determine a social media accountcorresponding to an entity of interest; generate a linked social networkdata structure linking the social media account corresponding to theentity of interest to one or more other social media accounts on thesocial media platform corresponding to other entities, wherein anindividual link is based on one or more social media interactionsbetween the social media account corresponding to the entity of interestand each of the one or more other social media accounts corresponding toother entities; assign an individual link risk measure to one or more ofthe individual links of the linked social network data structure, theindividual link risk measure based on a risk assessment of the one ormore social media interactions upon which the individual link is basedon; and determine a risk profile of the entity of interest based on anaggregated risk measure based on the linked social network datastructure comprising the individual link risk measures.